Week 32, 2021
9–15 August 2021
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2021-36380 Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.EPSS 98%
-
Critical 9.9
CVE-2021-26424 Windows TCP/IP Remote Code Execution VulnerabilityEPSS 61%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
-
Critical 9.8
CVE-2021-26432 Windows Services for NFS ONCRPC XDR Driver Remote Code Execution VulnerabilityEPSS 11%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809
- Critical 10.0 EPSS 2.4%
-
Critical 9.6
CVE-2021-38530 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16, RBS40 befo…EPSS 2.2%
-
Critical 10.0
CVE-2021-32798 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebookEPSS 2.1%
-
Critical 9.1
CVE-2021-21585 Dell OpenManage Enterprise versions prior to 3.6.1 contain an OS command injection vulnerability in RACADM and IPMI tools. A remote authenticated malicious use…EPSS 2.1%
-
Critical 9.6
CVE-2021-38528 Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D8500 before 1.0.3.58, R6900P before 1.3.2.132, R7000P b…EPSS 2%
-
Critical 9.6
CVE-2020-28589 An improper array index validation vulnerability exists in the LoadObj functionality of tinyobjloader v2.0-rc1 and tinyobjloader development commit 79d4421. A …EPSS 1.9%
-
Critical 9.6
CVE-2021-38513 Certain NETGEAR devices are affected by authentication bypass. This affects RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, RBS850 before 3.2.10.11, CBR40 be…EPSS 1.8%
-
Critical 9.8
CVE-2021-21564 Dell OpenManage Enterprise versions prior to 3.6.1 contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit …EPSS 1.6%
- Critical 9.8 EPSS 1.5%
-
Critical 10.0
CVE-2021-38516 Certain NETGEAR devices are affected by lack of access control at the function level. This affects D6220 before 1.0.0.48, D6400 before 1.0.0.82, D7000v2 before…EPSS 1.3%
- Critical 9.0
- Critical 9.6
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2021-37344 Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (…EPSS 97%
-
Unscored
CVE-2021-37350 Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation.EPSS 79%
-
Unscored
CVE-2021-33256 A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. Th…EPSS 79%
-
Unscored
CVE-2021-37346 Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Comma…EPSS 74%
-
Unscored
CVE-2021-37425 Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogether…EPSS 66%
-
High 7.5
CVE-2021-36942 Windows LSA Spoofing VulnerabilityEPSS 66%
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2016
- Unscored EPSS 60%
-
High 7.8
CVE-2021-34478 Microsoft Office Remote Code Execution VulnerabilityEPSS 52%
Microsoft · Microsoft 365 Apps for Enterprise · Microsoft Office 2019
Advisories
- SUSE / openSUSE Security Updates 451 critical
- Microsoft Security Response Center 438 critical
- Oracle Linux Security Advisories (ELSA) 20
- AlmaLinux Security Advisories 18
- Debian Security (DSA / DLA) 17
- BSI CERT-Bund (WID) 14
- Rocky Linux Security Advisories 13
- CISA ICS & IT advisories 121 critical
- Siemens ProductCERT 101 critical
- Ubuntu Security Notices (USN) 9
- Schneider Electric CPCERT 4
- CERT@VDE 21 critical
- Amazon Linux Security Center (ALAS) 1
- openSUSE-SU-2021:1134-1 Security update for python-CairoSVG, python-Pillow 13 CVEs
- VDE-2021-033 TRUMPF Laser GmbH: multiple products prone to codesys runtime vulnerabilities 8 CVEs
- MSRC-CVE-2021-34480 Scripting Engine Memory Corruption Vulnerability 1 CVEs
- MSRC-CVE-2021-34534 Windows MSHTML Platform Remote Code Execution Vulnerability 1 CVEs
- MSRC-CVE-2021-26428 Azure Sphere Information Disclosure Vulnerability 1 CVEs
- MSRC-CVE-2021-26430 Azure Sphere Denial of Service Vulnerability 1 CVEs
- MSRC-CVE-2021-36936 Windows Print Spooler Remote Code Execution Vulnerability 1 CVEs
- MSRC-CVE-2021-34530 Windows Graphics Component Remote Code Execution Vulnerability 1 CVEs
- MSRC-CVE-2021-26432 Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability 1 CVEs
- MSRC-CVE-2021-26424 Windows TCP/IP Remote Code Execution Vulnerability 1 CVEs